Lai-Massey Cipher Designs. History, Design Criteria and Cryptanalysis

Preface......Page 3
Acronyms......Page 5
Symbols......Page 7
Contents......Page 8
1.1 Symmetric and Asymmetric Ciphers......Page 13
1.2 Iterated (or Product) Ciphers......Page 17
1.3 Symmetric Cryptosystems......Page 23
1.4 Entropy......Page 25
1.5 Confusion and Diffusion......Page 26
1.6 Security Assumptions and Threat Models......Page 27
1.7 PRP and SPRP......Page 29
1.8 Modes of Operation......Page 30
1.9 Unconditional Security......Page 35
1.10 The Origins of the MESH Ciphers......Page 36
References......Page 40
2.1 The PES Block Cipher......Page 48
2.1.1 Encryption and Decryption Frameworks......Page 51
2.1.2 Key Schedule Algorithm......Page 52
2.2 The IDEA Block Cipher......Page 55
2.2.1 Encryption and Decryption Frameworks......Page 56
2.2.2 Key Schedule Algorithm......Page 58
2.3 The MESH Block Ciphers......Page 60
2.3.1 Encryption and Decryption Frameworks of MESH-64......Page 62
2.3.2 Key Schedule Algorithm of MESH-64......Page 66
2.3.3 Encryption and Decryption Frameworks of MESH-96......Page 69
2.3.4 Key Schedule Algorithm of MESH-96......Page 72
2.3.5 Encryption and Decryption Frameworks of MESH-128......Page 75
2.3.6 Key Schedule Algorithm of MESH-128......Page 79
2.3.7 Encryption and Decryption Frameworks of MESH-64(8)......Page 82
2.3.8 Key Schedule Algorithm of MESH-64(8)......Page 84
2.3.9 Encryption and Decryption Frameworks of MESH-128(8)......Page 88
2.3.10 Key Schedule Algorithm of MESH-128(8)......Page 91
2.4.1 Encryption and Decryption Frameworks......Page 94
2.4.2 Key Schedule Algorithm......Page 95
2.5 The WIDEA- Block Ciphers......Page 96
2.5.1 Encryption and Decryption Frameworks......Page 97
2.5.2 Key Schedule Algorithms......Page 100
2.6 The FOX/IDEA-NXT Block Ciphers......Page 101
2.6.1 Encryption and Decryption Frameworks......Page 102
2.6.2 Key Schedule Algorithms......Page 105
2.7.1 Encryption and Decryption Frameworks......Page 107
2.7.2 Key Schedule Algorithm......Page 110
2.8.1 Encryption and Decryption Frameworks......Page 111
2.8.2 Key Schedule Algorithm......Page 114
2.9.1 Encryption and Decryption Frameworks......Page 117
2.9.2 Key Schedule Algorithm......Page 119
2.10 The Bel-T Block Cipher......Page 120
2.10.1 Encryption and Decryption Frameworks......Page 121
2.10.2 Key Schedule Algorithm......Page 122
References......Page 123
3.1 Exhaustive Search (Brute Force) Attack......Page 127
3.2 Dictionary Attack......Page 130
3.3 Birthday-Paradox Attacks......Page 131
3.4 Time-Memory Trade-Off Attacks......Page 134
3.4.1 Hellman’s Attack......Page 137
3.4.2 Time/Memory/Data Trade-Off Attacks......Page 140
3.5 Differential Cryptanalysis......Page 141
3.5.1 DC of PES Under Weak-Key Assumptions......Page 155
3.5.2 DC of IDEA Under Weak-Key Assumptions......Page 159
3.5.2.1 Key-Recovery Attacks......Page 163
3.5.3 DC of MESH-64 Under Weak-Key Assumptions......Page 164
3.5.4 DC of MESH-96 Under Weak-Key Assumptions......Page 166
3.5.5 DC of MESH-128 Under Weak-Key Assumptions......Page 173
3.5.6 DC of MESH-64(8) Under Weak-Key Assumptions......Page 194
3.5.7 DC of MESH-128(8) Under Weak-Key Assumptions......Page 216
3.5.8 DC of WIDEA-n Under Weak-Key Assumptions......Page 228
3.5.8.1 Differential Attack Using One IDEA Instance Only......Page 229
3.5.8.2 Differential Attack Using All IDEA Instances......Page 232
3.5.8.3 WIDEA-n in Davies-Meyer Mode......Page 233
3.5.8.4 Weak Keys......Page 234
3.5.8.5 Weak Keys in WIDEA-4......Page 236
3.5.8.6 Weak keys in WIDEA-8......Page 239
3.5.9 DC of RIDEA Under Weak-Key Assumptions......Page 240
3.5.10 DC of REESSE3+ Under Weak-Key Assumptions......Page 246
3.5.11 DC of IDEA* Without Weak-Key Assumptions......Page 263
3.5.12 DC of YBC Without Weak-Key Assumptions......Page 264
3.6 Truncated Differential Cryptanalysis......Page 266
3.6.1 TDC of IDEA......Page 267
3.6.1.1 Experimental Results......Page 271
3.6.2 TDC of MESH-64......Page 275
3.6.3 TDC of MESH-96......Page 279
3.6.4 TDC of MESH-128......Page 282
3.6.5 TDC of WIDEA-n......Page 285
3.6.5.1 Key-Recovery Attack on WIDEA-n......Page 287
3.7 Multiplicative Differential Analysis......Page 290
3.8 Impossible-Differential Cryptanalysis......Page 292
3.8.1 ID Analysis of IDEA......Page 293
3.8.1.1 ID Attack on 3.5-round IDEA......Page 295
3.8.1.2 ID Attack on 4-round IDEA......Page 296
3.8.1.3 ID Attack on 4.5-round IDEA......Page 297
3.8.2 ID Analysis of MESH-64......Page 299
3.8.3 ID Analysis of MESH-96......Page 301
3.8.3.1 ID Attack on 3.5-round MESH-96......Page 303
3.8.4 ID Analysis of MESH-128......Page 306
3.8.4.1 Attack on 3.5-round MESH-128......Page 310
3.8.5 ID Analysis of MESH-64(8)......Page 313
3.8.5.1 Attack on 3.5-round MESH-64(8)......Page 314
3.8.6 ID Analysis of MESH-128(8)......Page 316
3.8.6.1 Attack on 3.5-round MESH-128(8)......Page 317
3.8.7 ID Analysis of FOX/IDEA-NXT......Page 320
3.8.7.1 ID Attack on 5-round FOX64......Page 322
3.8.7.2 ID Attack on 5-round FOX128......Page 323
3.8.8 ID Analysis of REESSE3+......Page 325
3.8.9 ID Analysis of IDEA*......Page 328
3.9 Slide Attacks......Page 329
3.9.1 Slide Attacks on IDEA......Page 330
3.9.2 Slide Attacks on MESH-64......Page 332
3.9.3 Slide Attacks on MESH-96......Page 334
3.9.4 Slide Attacks on MESH-128......Page 335
3.10.1 Advanced Slide Attacks on MESH-64......Page 336
3.11 Biclique Attacks......Page 337
3.11.1 Biclique Attacks on IDEA......Page 340
3.11.1.1 Biclique Attack on the Full 8.5-round IDEA......Page 341
3.11.1.2 Biclique Attack on 7.5-round IDEA......Page 344
3.12 Boomerang Attacks......Page 346
3.12.1 Boomerang Attacks on IDEA......Page 353
3.12.1.1 Boomerang Attacks on Reduced-Round IDEA......Page 371
3.12.2 Boomerang Attacks on MESH-64......Page 375
3.12.3 Boomerang Attacks on MESH-96......Page 377
3.12.4 Boomerang Attacks on MESH-128......Page 379
3.13 Linear Cryptanalysis......Page 380
3.13.1 LC of PES Under Weak-Key Assumptions......Page 390
3.13.2 LC of IDEA Under Weak-Key Assumptions......Page 394
3.13.3 New Linear Relations for Multiplication......Page 397
3.13.4 LC of MESH-64 Under Weak-Key Assumptions......Page 398
3.13.5 LC of MESH-96 Under Weak-Key Assumptions......Page 401
3.13.6 LC of MESH-128 Under Weak-Key Assumptions......Page 408
3.13.7 LC of MESH-64(8) Under Weak-Key Assumptions......Page 429
3.13.8 LC of MESH-128(8) Under Weak-Key Assumptions......Page 450
3.13.9 LC of WIDEA-n Under Weak-Key Assumptions......Page 459
3.13.10 LC of RIDEA Under Weak-Key Assumptions......Page 461
3.13.11 LC of REESSE3+ Under Weak-Key Assumptions......Page 464
3.13.12 LC of IDEA* Without Weak-Key Assumptions......Page 480
3.13.13 LC of YBC Without Weak-Key Assumptions......Page 482
3.14 Differential-Linear Cryptanalysis......Page 484
3.14.2 DL Analysis of IDEA......Page 486
3.14.3 Higher-Order Differential-Linear Analysis of IDEA......Page 490
3.14.4 DL Analysis of MESH-64......Page 492
3.14.5 DL Analysis of MESH-96......Page 493
3.15 Square/Multiset Attacks......Page 494
3.15.1 Square/Multiset Attacks on IDEA......Page 499
3.15.1.1 An Alternative Square/Multiset Attack on IDEA......Page 505
3.15.1.2 Square-Like Attacks on IDEA......Page 506
3.15.2 Square/Multiset Attacks on MESH-64......Page 509
3.15.3 Square/Multiset Attacks on MESH-96......Page 512
3.15.4 Square/Multiset Attacks on MESH-128......Page 514
3.15.5 Square/Multiset Attacks on MESH-64(8)......Page 518
3.15.6 Square/Multiset Attacks on MESH-128(8)......Page 522
3.15.7 Square/Multiset Attacks on REESSE3+......Page 527
3.15.8 Square/Multiset Attacks on FOX/IDEA-NXT......Page 528
3.16.1 Demirci Attack on MESH-64......Page 534
3.16.2 Demirci Attack on MESH-96......Page 536
3.16.3 Demirci Attack on MESH-128......Page 537
3.17.1 Biryukov-Demirci Attack on IDEA......Page 539
3.17.1.1 New Biryukov-Demirci Attacks on IDEA......Page 545
3.17.1.2 TMTO Biryukov-Demirci Attack on IDEA......Page 548
3.17.2 Biryukov-Demirci Attack on MESH-64......Page 550
3.17.3 Biryukov-Demirci Attack on MESH-96......Page 553
3.17.4 Biryukov-Demirci Attack on MESH-128......Page 554
3.17.5 Biryukov-Demirci Attack on MESH-64(8)......Page 556
3.17.6 Biryukov-Demirci Attack on MESH-128(8)......Page 558
3.18 Key-Dependent Distribution Attack......Page 560
3.18.1 Key-Dependent Attacks on IDEA......Page 563
3.19 BDK Attacks......Page 569
3.20 Meet-in-the-Middle Attacks......Page 573
3.20.1 Meet-in-the-Middle Attacks on IDEA......Page 574
3.20.1.1 Meet-in-the-Middle Biryukov-Demirci Attacks on IDEA......Page 576
3.20.1.2 TMTO Meet-in-the-Middle Biryukov-Demirci Attacks on IDEA......Page 577
3.20.2 More Meet-in-the-Middle Attacks on IDEA......Page 578
3.20.3 Improved Meet-in-the-Middle Attacks on IDEA......Page 582
3.20.4 Meet-in-the-Middle Attack on FOX128......Page 585
3.20.5 Improved ASR Attack on FOX Ciphers......Page 588
3.20.6 Improved ASR Attack on FOX64......Page 589
3.20.7 Improved ASR Attack on FOX128......Page 591
3.21 Related-Key Attacks......Page 593
3.21.1 RK Differential-Linear Attacks on IDEA......Page 594
3.21.2 Related-Key Keyless-BD Attack......Page 596
3.21.3 Related-Key Boomerang Attack on IDEA......Page 597
3.21.4 Further Related-Key Boomerang and Rectangle Attack on IDEA......Page 602
3.21.4.1 A Related-Key Boomerang Attack on 6-round IDEA......Page 603
3.21.4.2 A Related-Key Rectangle Attack on 6.5-round IDEA......Page 604
References......Page 605
4.1 XC1: Encryption and Decryption Frameworks......Page 615
4.1.2 Differential Analysis......Page 618
4.1.3 Linear Analysis......Page 622
4.2 XC2: Encryption and Decryption Frameworks......Page 627
4.2.1 Key Schedule Algorithm......Page 629
4.2.2 Differential Analysis......Page 630
4.2.3 Linear Analysis......Page 633
4.3 XC3: Encryption and Decryption Frameworks......Page 635
4.3.1 Key Schedule Algorithm......Page 637
4.3.2 Differential Analysis......Page 638
4.3.3 Linear Analysis......Page 640
4.4 XC4: Encryption and Decryption Frameworks......Page 642
4.4.2 Differential Analysis......Page 644
4.4.3 Linear Analysis......Page 646
References......Page 648
5.1 The Lai-Massey Design Paradigm......Page 649
References......Page 666
Monoids, Groups, Rings & Fields......Page 669
Differential & Linear Branch Number......Page 671
B.1 MDS Codes......Page 672
B.1.1 How to Construct MDS Matrices?......Page 674
B.2 Implementation Costs......Page 682
C.1 S-box Definition......Page 684
C.2 S-box Representations......Page 690
C.2.1 Examples of Real S-boxes......Page 712
References......Page 727
Index......Page 732